Developer · Weekly · March 4, 2026

aio agents in your deploy pipeline

Anthropic reports that over 80% of its deployed code is written by Claude, and individual engineers describe 2026 workflows where they don't write any code manually, leaning entirely on tools like Cursor, Claude, and Codex.[2]

Claude Code already accounts for about 4% of public GitHub commits, with surveys projecting this could exceed 20% by the end of 2026.[3] Coding agents crossed a reliability threshold in December and are now running long, multi-step tasks, with some developers wiring up 13 Claude agents to ship software every day.[4]

The downside is quantified: debugging AI-generated code takes roughly 3x longer than human code, and production incidents from AI bugs are averaging about $40,000 per hit.[5]

A vibe-coded app shipped with 16 vulnerabilities that exposed data from 18,000 users, and a scan of agent repos found 80% had at least one vulnerability, 38% of them critical.[6]

aI tooling as an attack surface

GitHub's Copilot CLI has been observed downloading and executing malware, turning a convenience tool into a direct code-execution risk on developer machines.[7]

OpenClaw, now the most-starred project on GitHub, comes with reports of over 2,000 known vulnerabilities and a new 'ClawJacked' web attack that lets sites hijack the agent.[8]

A broader review of AI agent repositories found that 80% contain at least one vulnerability and highlighted missing human oversight as the most common design flaw.[9] 41% of official MCP servers are running without authentication, even as France deploys a national MCP server hosting all government data and new CLIs let agents act over SSH on remote machines.[10]

On the credential side, 2,863 Google API keys sitting in public webpages now silently authenticate to Gemini and expose previously safe APIs via the assistant, and separate work estimates that 86% of production LLM apps are currently exposed to prompt injection.[11]

llm infra: kv cache, local vs cloud economics

Qwen3.5-35B-A3B hits about 74.7 tokens/s with a q8_0 KV cache on an RTX 5080, making it one of the faster large models for local inference.[12] The same A3B variant can stretch context windows past 1M tokens on 32GB consumer GPUs, but people are running into slowdowns tied to frequent KV-cache clearing rather than raw compute limits.[13]

Precision choices on the KV cache are directly changing correctness: fp8 KV produces corrupt outputs for Qwen3.5, while bf16 fixes the problem.[14]

Tooling like ContextCache shows 29x speedups by caching schema tokens for tool-calling LLMs, and KV-based communication between agents is saving roughly 73–78% of tokens in multi-agent setups.[15]

At the hardware level, the GPU market is described as highly inflated with capable gen-AI PCs often costing over $2,000, while cloud offerings like Colab's RTX 6000 Pro at $0.87/hr and cheap models like Gemini 3.1 Flash-Lite at $0.25 per million tokens are pulling a lot of heavy experimentation back to the cloud.[16]

infra stack: docker, k8s, and managed platforms

For small teams and homelabs, Docker and Docker Compose on bare metal or Proxmox remain the default: there’s a public catalog of 450+ self-hostable apps with Compose files, and people routinely run Nextcloud, media servers, and AI services as containers on Proxmox clusters.[17]

Users keep emphasizing that one-process-per-container with Compose makes upgrades and rollbacks trivial compared to traditional installs, while also repeatedly calling out security worries around privilege escalation and secrets inside containers.[18]

Full Kubernetes is mostly showing up where there’s real multi-node scale or AI workloads, and even there folks are fighting etcd pain at scale, CRD lifecycle breakage, and FluxCD taking too long to notice new images.[19]

On the hosted side, Supabase now powers 55% of a recent YC batch but has been blocked by ISPs in India under a government order, and Vercel had regional downtime in Dubai and the EU even as it launches an AI Agent marketplace and tight Claude Code integrations.[20]

Underneath, the data layer is coalescing into PostgreSQL for SaaS backends, SQLite for local and agent memory, and Redis for ephemeral context and JWT blacklists, with people explicitly calling out SQLite’s multi-user limits and Redis-based blacklists turning into hot-path bottlenecks.[21]

languages, runtimes, and wasm

Teams documenting migrations from PHP or Python/React to Elixir Phoenix report roughly 35% reductions in operational costs, plus simpler backends built on a surprisingly broad ecosystem of Elixir-based tooling and tutorials.[22]

Ruby on Rails is still being chosen over React-only stacks for some web apps, with developers pointing at better performance for their workloads and a preference for straightforward CRUD over JS-heavy frontends.[23]

In the systems layer, Rust and Go are increasingly used for infra and agent services, visible in Rust-based Frankensqlite with concurrent writers, a 1.4 GB/s Rust FITS image processor, and a Go community explicitly positioning the language as a top choice for AI agents.[24]

JavaScript and TypeScript remain unavoidable for frontends and much AI tooling, but people are openly venting about design flaws, complex async semantics, and type-system overkill even as multi-year migrations from JS to TS grind on.[25]

WebAssembly is being treated as a precision tool rather than a full runtime, with a WASM vector DB running 5x faster than JS on one side and a JVM-in-QEMU-in-WASM that takes 55 seconds just to print 'Hello World' on the other.[26]